A second-order security vulnerability detection method for Java database interaction application

Abstract

The application discloses a second-order security vulnerability detection method for Java database interaction application, and comprises the following steps: S1, setting a source point, a sink point and a pollution propagation rule of a pollution analysis according to a category of the second-order security vulnerability; S2, processing a target program to be detected to obtain a static analysis IR; S3, combining a configuration file related to database interaction in a target program code, performing a pointing analysis on the IR generated in the step S2 to generate a pointing flow graph (PFG) and a method call graph (CG) connected with the Java application and the database; and S4, performing a pollution analysis on the IR generated in the step S2 based on the pollution analysis rule set in the step S1 and the pointing flow graph and the method call graph obtained in the step S3. Compared with a traditional vulnerability detection method for the Java application, the application collects a pollution flow between the Java application and the database by constructing a static analysis channel between the Java application and the database, so that the second-order security vulnerability detection is realized.

Description

TECHNICAL FIELD

[0001] The application relates to a second-order security vulnerability detection method for a Java database interaction application and belongs to the technical field of vulnerability detection and static analysis. BACKGROUND

[0002] Relational databases are widely used in today's Java applications. When an application needs to access data residing in a relational database server, it uses the API provided by database frameworks such as JDBC to execute SQL statements. Due to the complexity of the persistence process and the transparency of the database framework, there are many security issues with Java applications that interact with databases. In 2021, OWASP listed the top ten web application security risks, including injection vulnerabilities and information leakage, which are related to databases.

[0003] Injection vulnerabilities can generally be divided into first-order injection vulnerabilities and second-order injection vulnerabilities. Both are security vulnerabilities related to user input. Unlike first-order injection vulnerabilities, second-order vulnerabilities do not directly attack the application through user input, but store user input into the application's database or file and use the data in subsequent queries or operations, resulting in security vulnerabilities being exploited. When the application uses this data in subsequent queries or operations, attackers can input specific data to achieve attacks, thereby bypassing the security measures of the application. For example, attackers can perform SQL injection attacks using malicious data stored in the database to obtain sensitive information or control the application. Compared with first-order injection vulnerabilities, second-order vulnerabilities are more difficult to detect and prevent because attackers need to wait for the application to use malicious data, rather than directly exploiting user input.

[0004] For Java applications, traditional injection vulnerability detection is mainly divided into dynamic analysis and static analysis. Fuzzing is an important dynamic analysis technique. The technique first collects the API of the web application through web crawler technology, then uses test cases generated by careful construction or algorithm to trigger the API, and finally combines the return value of the API and the abnormal reaction of the application to detect vulnerabilities. Dynamic analysis has the advantage of low false positive rate, but is usually affected by test cases, with a high false negative rate. For static analysis, the commonly used technique is the taint analysis based on pointer analysis to detect injection vulnerabilities. Pointer analysis is responsible for building the PFG and CG of the application, and taint analysis collects the taint flow existing in the application to identify potential injection vulnerabilities. Since the current static analysis cannot understand the interaction process between Java applications and databases, it cannot build the PFG connected to the Java application and the database, which leads to the fact that taint analysis cannot collect the taint flow between the Java application and the database, so that the second-order security vulnerability cannot be effectively detected. SUMMARY

[0005] The present application provides a second-order security vulnerability detection method for Java database interaction application, which can detect second-order security vulnerabilities by building a PFG connected to the Java application and the database and collecting the taint propagation path between the Java application and the database.

[0006] Technical scheme: A second-order security vulnerability detection method for Java database interaction application, the method comprising the following steps:

[0007] S1, according to the category of second-order security vulnerabilities, set the taint analysis rules, which include Source points, Sink points and taint propagation rules;

[0008] S2, process the target program to be detected to obtain the result IR for static analysis;

[0009] S3, combine the configuration file related to the database interaction in the target program code, and perform pointer analysis on the IR generated in step S2 to generate the PFG and CG connected to the Java application and the database;

[0010] S4, based on the taint analysis rules set in step S1 and the PFG and CG obtained in step S3, perform taint analysis on the IR generated in step S2.

[0011] Preferably, the category of the second-order security vulnerability in the step S1 is: in the second-order XSS attack vulnerability, setting the user input point such as the String parameter of the WebAPI as the Source point, setting the method related to the Web page construction as the Sink point, and setting the String related operation as the propagation taint.

[0012] Preferably, the category of the second-order security vulnerability in the step S1 is: in the second-order SQL injection vulnerability, setting the user input point such as the String parameter of the WebAPI as the Source point, setting the method related to the SQL execution as the Sink point, and setting the String related operation as the propagation taint.

[0013] Preferably, in the step S2, the target program code to be detected is processed by using the open source framework Tai-e to obtain the result three address code IR for static analysis.

[0014] Preferably, the step S3 includes:

[0015] S31, for the part of the IR related to the user code, a traditional Statement-oriented taint analysis method is used to construct the user code part of the taint flow graph and the method call graph.

[0016] S32, for the part of the IR related to the database framework code, the semantics of the API provided by the database framework is modeled to replace the analysis of the framework source code, and an API-oriented taint analysis method is used to construct the database part of the taint flow graph and connect the user code part and the database part of the taint flow graph.

[0017] S33, for the part of the IR related to other framework codes, an existing modeling method or a traditional taint analysis method is used to further perfect the taint flow graph and the method call graph.

[0018] Preferably, in the step S32, the semantics of the API provided by the database framework is modeled to replace the analysis of the framework source code, that is, the modeling of the database framework API, which specifically includes:

[0019] S321, modeling the database involved by the application. Since the modeling of the database framework API aims to abstract the interaction between the Java application and the database, the analyzer needs to first construct a static abstraction for the database. According to the structure of the database table defined by the Create Table statement in the SQL file, and in combination with the SQL statements involved by the application code, the database is abstracted into a collection of database tables. Each database table has several columns, and each column corresponds to a pointer in the taint analysis.

[0020] S322, modeling the API related to creating SQL Statement. The API for creating SQL Statement is like "statement = connection. prepareStatement(sql)", whose semantics is to create a PreparedStatement object for executing the SQL statement specified in the parameter. The analyzer adds the abstract Statement object O s to the collection pointed by statement variable. s where O s implies two attributes O s .sql and O s .params. The former corresponds to the SQL statement to be executed, and the latter corresponds to the parameter list of the SQL statement.

[0021] S323, modeling the API related to setting SQL Statement parameter. The API for setting SQL Statement parameter is like "statement. setObject(index, value)", where index represents the index variable and value represents the parameter variable, whose semantics is to set the parameter value as the corresponding SQL parameter according to the index value. According to the index value i pointed by index variable, the analyzer takes out the object O s from the collection pointed by statement variable, selects the i-th element O s .params[i] of its list attribute, and constructs the PFG Edge from value variable to O s .params[i].

[0022] S324, modeling the API related to executing SQL Statement. The API for executing SQL Statement is like "result = statement.executeQuery()" and "statement.executeUpdate()", whose semantics is to execute the select statement implied in the SQL Statement and convert the query result into ResultSet object, and the semantics of the latter is to execute the insert or update statement implied in the SQL Statement. The analyzer performs different processing according to the SQL attribute of the object pointed by statement variable.

[0023] 1) When O s .sql represents a write operation, the analyzer identifies the table and column involved in the SQL, and constructs the PFG Edge from O s .params to the column pointer in order.

[0024] 2) When O s .sql represents a read operation, the analyzer identifies the table and column involved in the SQL, and constructs the PFG Edge from O s .params to the column pointer in order.s When a read operation is performed (.sql), the parser adds an abstract Result object O to the collection pointed to by the result variable. r O r Contains O r The `.columns` attribute represents the list of query results. Simultaneously, the analyzer identifies the tables and columns involved in the SQL query and constructs column pointers to the O(login) in sequence. r PFG Edge for .columns.

[0025] S325. Modeling APIs related to reading SQL Statement execution results; the API for reading SQL Statement execution results is in the form of "object = result.getObject(index)", where index represents an index variable, and its semantics are to retrieve the corresponding column from the query results based on the index value. Based on the index value i pointed to by the index variable, the analyzer retrieves the object O pointed to by the result variable. r Select the i-th element O of the result list attribute. r .columns[i], constructing O r .columns[i] is the PFG edge of the object pointer.

[0026] Preferably, in step S4, taint analysis, taint objects are written to the set pointed to by the corresponding pointer according to the settings of the Source. According to the settings of the Sink, it is checked whether a taint object exists in the set pointed to by the Sink parameter variable in the application code. If a taint object is found, the taint path from the Source to the Sink is output, representing a potential second-order security vulnerability.

[0027] Beneficial effects: Compared with existing technical solutions, the present invention has the following advantages:

[0028] 1) This invention provides a pointer analysis method for Java database interaction applications. This method can construct a pointer flow graph connecting Java applications and databases.

[0029] 2) This invention provides a taint analysis method for second-order security vulnerabilities. This method, based on pointer analysis, can collect taint flows between Java applications and databases, thereby identifying potential second-order security vulnerabilities in the application.

[0030] 3) The pointing analysis and taint analysis methods proposed in this invention are also applicable to detecting other security vulnerabilities related to database interaction. Attached Figure Description

[0031] Figure 1 This is a flowchart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The present application is further illustrated by the following specific examples, which should not be construed as limiting the scope of the present application. After reading the present application, those skilled in the art will be able to affect various modifications to the present application.

[0033] As shown in the method for detecting second-order security vulnerabilities of Java database interaction applications, the method comprises the following steps: Figure 1

[0034] S1, according to the category of second-order security vulnerabilities, set the Source point, Sink point and the propagation rule of the taint analysis;

[0035] In the case of second-order XSS attack vulnerabilities, set the user input point such as the String parameter of the Web API as the Source point, set the method related to the construction of the Web page as the Sink point, and set the String related operation to propagate the taint.

[0036] In the case of second-order SQL injection vulnerabilities, set the user input point such as the String parameter of the Web API as the Source point, set the method related to the execution of the SQL as the Sink point, and set the String related operation to propagate the taint.

[0037] S2, process the target program to be detected to obtain the static analysis IR;

[0038] In the process of the target program code to be detected, the open source framework Tai-e is used to process the target program code to obtain the result three address code IR for static analysis.

[0039] S3, combine the configuration file related to the database interaction in the target program code, and perform the pointing analysis on the IR generated in step S2 to generate the pointing flow graph (PFG) and the method call graph (CG) connecting the Java application and the database;

[0040] S31, for the part of the IR related to the user code, the traditional pointing analysis method for Statement is used to construct the user code part of the pointing flow graph and the method call graph.

[0041] S32, for the part of the IR related to the database framework code, the semantics of the API provided by the database framework is modeled to replace the analysis of the source code of the framework, so as to construct the database part of the pointing flow graph and connect the user code part and the database part of the pointing flow graph.

[0042] ​S33, for the part of IR related to other framework code, the existing modeling method or traditional points-to analysis method is used to further improve the points-to flow graph and method call graph.

[0043] Preferably, in the step S32, the analysis of the framework source code is replaced by modeling the semantics of the API provided by the database framework, i.e. the modeling of the database framework API, specifically including:

[0044] S321, modeling the database involved by the application. Since the modeling of the database framework API aims to abstract the interaction between the Java application and the database, the analyzer needs to first construct a static abstraction for the database. According to the structure of the database table defined by the Create Table statement in the SQL file, and in combination with the SQL statements involved by the application code, the database is abstracted into a collection of database tables. Each database table has several columns, and each column corresponds to a pointer of the points-to analysis.

[0045] S322, modeling the API related to creating SQL Statement. The API for creating SQL Statement is in the form of "statement = connection.prepareStatement(sql)", and its semantics is to create a PreparedStatement object for executing the SQL statement specified in the parameter. The analyzer adds the abstract Statement object O s to the points-to set of the statement variable. s , which contains two attributes O s .sql and O s .params. The former corresponds to the SQL statement to be executed, and the latter corresponds to the parameter list of the SQL statement.

[0046] S323, modeling the API related to setting SQL Statement parameters. The API for setting SQL Statement parameters is in the form of "statement.setObject(index, value)", where index represents the index variable and value represents the parameter variable, and its semantics is to set the parameter value as the corresponding SQL parameter according to the index value. According to the index value i pointed by the index variable, the analyzer takes the object O s from the points-to set of the statement variable, selects the i-th element O s .params[i] of the list attribute of the object, and constructs a PFG edge from the value variable to O s .params[i].

[0047] S324, modeling the API related to the execution of SQL Statement. The API for executing SQL Statement is like "result = statement.executeQuery()" and "statement.executeUpdate()". The former means to execute the select statement in the SQL Statement and convert the query result into ResultSet object. The latter means to execute the insert or update statement in the SQL Statement. The analyzer processes the statement variable pointing to the object according to the SQL attribute of the object.

[0048] 1) When O s .sql represents the write operation, the analyzer identifies the table and column involved in the SQL and constructs the O s .params to the column pointer PFG Edge in order.

[0049] 2) When O s .sql represents the read operation, the analyzer adds the abstract Result object O r to the result variable pointing collection. r , where O r .contains O r .columns attribute, representing the query result list. At the same time, the analyzer identifies the table and column involved in the SQL and constructs the column pointer to the O r .columns PFG Edge in order.

[0050] S325, modeling the API related to the execution of SQL Statement; the API for reading the execution result of SQL Statement is like "object = result.getObject(index)", where index represents the index variable, and its semantics is to take the corresponding column from the query result according to the index value. According to the index value i pointed by the index variable, the analyzer takes the object O r .columns[i] of the result list attribute, constructs the O r .columns[i] to the object pointer PFG Edge.

[0051] S4, based on the taint analysis rules set in step S1, and the directed graph and method call graph obtained in step S3, perform taint analysis on the IR generated in step S2. According to the settings of the Source, write the taint object into the corresponding set of pointers. According to the settings of the Sink, check whether there is a taint object in the set of pointers of the Sink point parameter variable in the application code. If a taint object is found, output the taint path from the Source point to the Sink point, representing a potential second-order security vulnerability.

[0052] Since the present application belongs to a static analysis method for Java code, the specific implementation method will be introduced below in combination with a Java code example. The example code shows two Web APIs, a create API for writing data into a database, and a query API for querying data in the database.

[0053] Line 1, @PostMapping

[0054] Line 2, public void create(String taint) {

[0055] Line 3, / / Get a connection to the database

[0056] Line 4, Connection con = DriverManager.getConnection(...);

[0057] Line 5, / / Create a SQL statement

[0058] Line 6, String sql = "INSERT INTO t(val) VALUE (?)";

[0059] Line 7, / / Create a SQL Statement

[0060] Line 8, PreparedStatement statement = con.prepareStatement(sql);

[0061] Line 9, / / Set SQL parameters

[0062] Line 10, statement.setObject(1, taint);

[0063] Line 11, / / Execute SQL

[0064] Line 12, statement.executeUpdate();

[0065] Line 13,}

[0066] Line 14, @GetMapping

[0067] Line 15, public void query(){

[0068] Line 16, / / Get a connection to the database

[0069] Line 17, Connection con = DriverManager.getConnection(...);

[0070] Line 18, / / Create a SQL statement

[0071] Line 19, String sql = "SELECT * FROM t";

[0072] Line 20, / / Create a SQL Statement

[0073] Line 21, PreparedStatement statement = con.prepareStatement(sql);

[0074] Line 22, / / Execute the SQL

[0075] Line 23, ResultSet result = statement.executeQuery();

[0076] Line 24, / / Extract the query results

[0077] Line 25, while (result.next()) {

[0078] Line 26, String object = (String) result.getObject(1);

[0079] Line 27, sink(object);

[0080] Line 28,}

[0081] Line 29,}

[0082] When the category of the second-order security vulnerability to be detected in step S1 is a second-order XSS attack vulnerability, set the String parameter of the Web API or the like as the Source point, set the method related to the Web page construction as the Sink point, and set the String related operation to propagate the taint. When the category of the second-order security vulnerability to be detected in step S1 is a second-order SQL injection vulnerability, set the String parameter of the Web API or the like as the Source point, set the method related to the SQL execution as the Sink point, and set the String related operation to propagate the taint. For the example code, mark the taint variable of the parameter taint of the create method in the code fragment as the Source point (line 2), mark the sink method related to the UI construction in the query method as the Sink point (line 27), and mark the create method and the prepareStatement method representing the SQL Statement creation in the query method as the Sink point (line 8, line 21).

[0083] In step S2, the open source framework Tai-e is used to process the program code, and a three-address IR for static analysis is obtained.

[0084] The purpose of the taint analysis in step S3 is to build a taint flow graph connecting the Java application and the database, and the taint analysis specifically includes

[0085] S31, for the part of the IR related to the user code, a traditional Statement-oriented taint analysis method is used to build the user code part of the taint flow graph and the method call graph.

[0086] S32, for the part of the IR related to the database framework code, the semantics of the API provided by the database framework is modeled to replace the analysis of the framework source code in combination with the configuration file related to the database interaction in the target program code, and an API-oriented taint analysis method is used to build the database part of the taint flow graph and connect the user code part and the database part of the taint flow graph.

[0087] S33, for the part of the IR related to other framework code, an existing modeling method or a traditional taint analysis method is used to further improve the taint flow graph and the method call graph.

[0088] For the example code, the taint analysis in step S31 builds the object O sql1 for the sql variable in the create method (line 6), and builds the object O sql2 for the sql variable in the query method (line 19).

[0089] The analysis of the pointer to the database framework in step S32 specifically includes:

[0090] S321, modeling the database involved by the application;

[0091] S322, modeling the API related to the creation of the SQL Statement;

[0092] S323, modeling the API related to the setting of the parameters of the SQL Statement;

[0093] S324, modeling the API related to the execution of the SQL Statement;

[0094] S325, modeling the API related to the reading of the result of the execution of the SQL Statement.

[0095] For the example code, step S321 models the database involved by the application, creating in the PFG a pointer t.val representing the val column of the table t (line 6).

[0096] For the example code, step S322 models the API related to the creation of the SQL Statement, the analyzer adding to the set of pointers of the statement variable of the create method the object O s1 (line 8), where O s1 implies two attributes, O s1 .sql and O s1 .params; the former corresponds to the SQL statement to be executed, and the latter corresponds to the list of parameters of the SQL statement; likewise, step S322 models the API related to the creation of the SQL Statement, the analyzer adding to the set of pointers of the statement variable of the query method the object O s2 (line 21);

[0097] For the example code, step S323 models the API related to the setting of the parameters of the SQL Statement, constructing a PFG Edge from the taint variable to O s1 .params[1] in the create method according to the index value 1 pointed to by the index variable (line 10);

[0098] For the example code, step S324 models the API related to the execution of the SQL Statement, O s1 .sql representing a write operation, the analyzer constructing a PFG Edge from O s1 .params[1] to t.val (line 12). O s2 .sql representing a read operation, the analyzer adding to the set of pointers of the result variable the abstract object Or (implicating O r .columns attribute) and constructs a PFG Edge from O r .columns[1] to the t.val pointer (line 23).

[0099] For the example code, step S325 models the API that reads the result of the SQL Statement execution, and constructs a PFG Edge from O r .columns[1] to the object variable (line 26).

[0100] For the example code, step S4's taint analysis, based on the taint analysis rules set in step S1 and the pointer flow graph and method call graph obtained in step S3, according to the configuration of the Source point, the analyzer adds the tainted object O taint (line 2) into the pointer set of the taint variable of the create method. Accompanying the parameter setting process of the SQL Statement, O taint flows into the pointer set of O s1 .params[1] (line 10). Accompanying the writing process, O taint flows into the pointer set of the pointer t.val representing the val column of the database table t (line 12). Accompanying the reading process, O taint flows into the pointer set of O r .columns[1] (line 23). Accompanying the reading process of the query result, O taint flows into the pointer set of the object variable (line 26). Finally, accompanying the calling process of the sink method, O taint flows into the sink method (line 27). Based on the PFG generated by the pointer analysis connecting the Java application and the database, the taint analysis collects the taint flow from the taint parameter of the create method to the sink method of the query method, successfully detecting the second-order XSS attack vulnerability implied by the code fragment.

[0101] It should be apparent to those skilled in the art that the steps of the methods of the embodiments described above can be implemented with general computing devices, which can be centralized on a single computing device or distributed across a network of multiple computing devices, and optionally, they can be implemented with program code executable by a computing device, which can be stored in a storage device and executed by a computing device, and in some cases, the steps shown or described can be executed in a different order than shown or described, or they can be made into individual integrated circuit modules or multiple modules or steps can be made into a single integrated circuit module. Thus, the embodiments are not limited to any particular combination of hardware and software.

Claims

1. A method for detecting second-order security vulnerabilities in Java database interaction applications, characterized in that, The method comprises the following steps: S1, setting a taint analysis rule according to a category of a second-order security vulnerability, the taint analysis rule comprising a Source point, a Sink point and a taint propagation rule; S2, processing a target program to be detected to obtain a result IR for static analysis; S3, combining a configuration file related to database interaction in the target program code, and performing a flow analysis on the IR generated in step S2 to generate a flow graph and a method call graph of the Java application connected with the database; S4, performing a taint analysis on the IR generated in step S2 based on the taint analysis rule set in step S1 and the flow graph and the method call graph obtained in step S3; The flow analysis in step S3 specifically comprises: S31, for a part of the IR related to user code, a flow analysis method for Statement is used to construct a user code part of the flow graph and the method call graph; S32, for a part of the IR related to database framework code, a flow analysis method for API is used to construct a database part of the flow graph by modeling semantics of the API provided by the database framework to replace analysis of the framework source code, and the user code part and the database part of the flow graph are connected; S33, for a part of the IR related to other framework code, a flow analysis method is used to further perfect the flow graph and the method call graph; In step S32, the semantics of the API provided by the database framework is modeled to replace analysis of the framework source code, that is, modeling of the database framework API specifically comprises: S321, modeling a database involved by the application; the database is abstracted into a set of database tables according to a structure of a database table defined by a Create Table statement in a SQL file and in combination with SQL statements involved by the application code; each database table has a plurality of columns, and each column corresponds to a pointer of the flow analysis; S322, API related to modeling creating SQL Statement; API for creating SQL Statement; the analyzer adds the abstract Statement object O to the collection of pointers to statement variables s where O s implies two attributes O s .sql and O s .params, the former corresponds to the SQL statement to be executed, and the latter corresponds to the parameter list of the SQL statement; S323, modeling set SQL Statement parameter related API; set SQL Statement parameter API, according to the index value i pointed by the index variable, the analyzer takes the object O from the pointing set of the statement variable s , select the i-th element O of the list attribute of the selected list s .params[i], build the PFG Edge of the value variable to O s .params[i] S324, modeling an API related to execution of a SQL statement; the API for executing the SQL statement is analyzed according to a SQL attribute of a statement variable pointing to an object for different processing; S325, modeling reading SQL Statement execution result related API; reading SQL Statement execution result API, according to the index variable points to the index value i, the analyzer takes out the object O pointed to by the result variable r , select the i-th element O of the result list attribute of the selected result r .columns [i], build O r .columns [i] to object pointer PFG Edge.

2. The method for detecting the second security vulnerability of the Java database interaction application of claim 1, wherein, In step S1, the category of the second-order security vulnerability is that, in a second-order XSS attack vulnerability, a user input point of a Web API is set as the Source point, a method related to Web page construction is set as the Sink point, and a String related operation is set as the taint propagation.

3. The method for detecting the second security vulnerability of the Java database interaction application of claim 1, wherein, In step S1, the category of the second-order security vulnerability is that, in a second-order SQL injection vulnerability, a String parameter user input point of a Web API is set as the Source point, a method related to SQL execution is set as the Sink point, and a String related operation is set as the taint propagation.

4. The method of claim 1, wherein the method further comprises: determining whether the application is a Java application; and if the application is a Java application, determining whether the application is a Java application that is configured to access a database. In step S2, the open source framework Tai-e is used to process the target program code to obtain a result three-address code IR for static analysis.

5. The method of claim 1, wherein the method further comprises: determining whether the application is a Java application; and if the application is a Java application, determining whether the application is a Java application that is configured to access a database. In S324, the analyzer performs different processing according to the SQL attribute of the object pointed to by the statement variable: 1) When O s When.sql represents a write operation, the analyzer identifies the tables and columns involved in the SQL and constructs O s .params to column pointer PFG Edge; 2) When O s When a read operation is performed (.sql), the parser adds an abstract Result object O to the collection pointed to by the result variable. r O r Contains O r The `.columns` attribute represents the list of query results; simultaneously, the analyzer identifies the tables and columns involved in the SQL and constructs column pointers to O in sequence. r PFG Edge for .columns.

6. The method of claim 1, wherein the method further comprises: determining whether the application is a Java application; and if the application is a Java application, determining whether the application is a Java application that is configured to access a database. In the step S4, according to the setting of the Source, the pointing set corresponding to the pointer is written with the tainted object; according to the setting of the Sink, it is checked whether the pointing set of the Sink point parameter variable in the application code exists the tainted object; if the tainted object is checked out, the tainted path from the Source point to the Sink point is output, representing the potential second-order security vulnerability.

Images